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A^iMlC-SYSJ^ OF ROUTE 

MANAGEMENT AMD ALARM COMMUNICATIONS 
Technical Field 

This invention relates to an avionic system and ground station for aircraft out of 
5 route management and alarm communications. More particularly, it relates to a 
system for handling events in case of deviations from the authorized flight paths 
and from the pre-set altitude or flight level or spatial limits, and automatically 
transmitting the onboard situation in real time to ground control stations when 
potentially dangerous events occur. 

10 Background Art 

Out of route aircraft caused particularly serious events, including loss of life. This 
situation has been traditionally handled by equipping the plane with flight 
instruments able to display the real time situation to the pilots and to transmit to 
ground the security codes entered by the pilots. Given the inadequacy of said 

15 means to handle complex situations, the above mentioned avionic system and 
ground station allows civil aircraft to temporarily operate independently from the 
pilot, in order to protect the civilian population. This system allows the aircraft to 
automatically react to deviations from the authorized flight paths and from the pre- 
set altitude or flight level or spatial limits, and is able to convey the exact onboard 

20 situation in real time to ground control stations when potentially dangerous events 
occur such as pilot errors, particular atmospheric conditions, failures, chaos, 
hijackings, and so forth. 
Summary of the Invention 

It is the main object of this invention to provide an avionic system and ground 
25 station for aircraft out of route management and alarm communications that is 
able to actively control the aircraft route and convey the onboard situation to 
ground stations in the event of an alarm, effectively increasing aircraft safety and 
security for passengers population and residential areas benefit. 
It is another object of the invention to provide a system that can be easily installed 
30 and used on aeroplanes, in compliance with commercial aviation regulations. 

These objects, and others that shall become readily apparent from the following 
description, are met according to a first aspect of the invention, a control function 
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for managing out of route aircraft (collision avoidance) with the features of claim 1 
and, in accordance with another aspect of the invention by means of a method for 
aircraft out of route. management according to claim 9. 

The above functions are performed by an avionic device (which will be certified for 
flight) and are suitable for improving the day-to-day flight safety, increasing the 
passengers and the civilian population safety. Implementing the solution in 
accordance with the invention following targets has significant advantages: 
maximum possible safety for the passengers; real time alarms detection and 
appropriate reactions; appropriate emergencies handling; automatic events 
detection independently from human intervention; reliable processing of alarm 
signals and secure communication with ground control stations; standardized 
interfaces to allow installation on the greatest possible number of aeroplanes. 
The above functions and targets are achieved by means of a system consisting of 
different elements: an avionic device, which carries out "collision avoidance" and 
"alarm" functions; suitable sensors, and on board transmitters; a ground control 
station composed by computing systems. The device is installed in a specific 
protected housing of the aircraft; it is not accessible and cannot be disabled from 
the cockpit 

The first function, "collision avoidance", is performed in the device and intervenes 
temporarily and independently of the pilot as soon as the aircraft deviates from the 
pre-set flight path, regardless of the causes. This could occur, for example, if the 
aircraft flyes in not allowed directions or descends below the altitudes/flight levels 
authorized by the air-traffic control regulations. The second function, "alarm", is 
also performed in the device and enables the above mentioned ground control 
stations to receive all the necessary information from the aircraft (for example, 
routes data and images) for carrying out appropriate evaluations when potentially 
dangerous events occur. 

Further advantages of the invention shall be readily apparent from the more 
detailed description of a particular embodiment of the invention, given as a non- 
limiting example with reference to the following accompanying drawings: 
Figure 1 and 2 show a schematic diagram of an aircraft that uses the system of 
the invention 
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Figure 3. shows a schematic , diagram of a runway, which shows approaching 
aeroplane limits and gives an environment indication related to the system of the 
invention 

Description of a preferred embodiment 

Figure 1 shows an aircraft that uses the system of the invention. The authorized 
flight path is the upper one; the permissible limits for said flight path are also 
shown - if the aircraft descends below these limits, the system automatically 
intervenes temporarily by making the aircraft climb to the above said altitude limit 
and informing the ground control stations of the alarm condition (Figure 2). 
Figure 3 shows a schematic diagram of an airport runway. The virtual cones set 
the spatial limits for containing the flying aircraft - if the aircraft descends below 
these, limits, the system automatically temporarily intervenes making the aircraft 
climb to a defined limit altitude and informing the ground control stations of the 
alarm condition. To maximize safety the system properly considers the land 
orography, buildings, nearby aircraft, the missing approach volumes and the 
authorized circling areas. 

The system, in accordance with the invention, is composed by an avionic device 
installed onboard commercial and general aviation aircraft, several sensors and 
transmitters installed in appropriate points of the aircraft, and connections between 
said sensors and the avionic device. The system exchanges information with 
ground control stations specifically designed to handle the data transmitted from 
the aircraft and to perform secure communication with the avionic device. 
The avionic device comprises CPU (Central Processor Unit) suitable for handling 
all the data at the required processing speed, specific software, electronic 
components; it has memory devices suitable for storing the world flight paths data 
and relevant limits, the world's airports positions and relevant limits, any other 
required data; input and output interfaces suitable for exchanging the required, 
information and data between the aircraft, other nearby aircrafts and the ground 
control stations. 

The "collision avoidance" function, which is one of the functions carried out by the 
avionic device, is not only used to avoid collisions when the aircraft is flying, but 
also during landing and take-off. When controlling the aircraft route, the unit 
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operates based on the_global authorized minimum cruising altitudes and flight 
levels, the so-called "limits", covering every area of the globe, always in 
compliance with all the civil aviation regulations, including the ICAO ones. As a 
non limiting example, when the aircraft is out of route or descends below the said 
limits (see Figure 1), the unit automatically temporarily intervenes through 
appropriate connections with the unit itself, the autopilot and the navigation 
system. 

During take-off and landing, the unit operates by creating virtual cones that delimit 
air space and considering the land orography, the flying and ground obstacles, 
and all other data of interest (as shown schematically in Figure 3); these data for 
every area of the globe are stored in the storage unit of the system as necessary. 
The "collision avoidance" function is carried out through two states. In the first 
state, the so-called "monitoring state", the unit constantly compares the position of 
the aircraft with the pre-set and stored authorized limits. The unit continuously 
receive the data through its interfacing with the navigation system of the aircraft 
and its sensors. The limits depend on the flight areas, the applicable regulations, 
the man-built constructions, obstacles and many other factors. For example, the 
stored data includes the coordinates of ail the world's airports and all the landing 
and take-off procedures established in compliance with the ICAO regulations. All 
the necessary information is kept up to date in real time, so that any changes to 
the above parameters are considered when competent authorities or aeronautical 
bodies change it, and this is accomplished through appropriate automatic updating 
procedures performed connecting the unit to ground control stations through data 
links (links described in the alarm function). 

In the second state, the so-called "control state", when the aircraft deviates from 
the authorized limits the unit intervenes automatically on the autopilot, through the 
aforementioned interfaces, to take the aircraft to its spatial limit. 
The preferred version of the aircraft out of route management system is as follows: 
in the monitoring state, it allows all the aircraft flying at altitudes or flight levels 
higher than the pre-set limit (established by the ICAO regulations for the different 
flight paths) to stay under the direct pilot control, also allowing flight path changes 
above the limit altitude or flight level (alarms will be generated only in case of big 
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flight path changes). The transition to the control state only occurs if the aircraft 
leaves its route to fly in unauthorized directions or descend below the pre-set limit. 
In this case, the unit temporarily takes control of the aircraft, through the collision 
avoidance function, to make the aircraft climb- to the pre-set limit. Once the safety 
limits have been restored, the system gives the control back to the pilot. 
The preferred version of the collision avoidance function during landing and take- 
off is as follows: for each airport two virtual cones (one in the landing direction and 
one in the take-off direction) are designed via software, in compliance with the 
instrument approach procedure, the missed approach procedure and virtual 
circling areas for the concerned runways. When the aircraft is involved in landing 
or take-off phases, the unit may also command the autopilot and temporarily take 
the control of the aircraft to place it in a predetermined position at a safety height. 
For example, this can occur in the following cases: 

- If during the approach procedure in the landing cone the aircraft suddenly flies 
below the cone limits (alarms will be generated if it flies out the cone above the 
limits); 

- If the aircraft flies at a speed considered incompatible with the landing and 
missed approach procedures; 

- If during climbing or after flying over the runway, the aircraft suddenly flies below 
the cone limits (alarms will be generated if it flyes out the cone above the limits). 
The collision avoidance function is constantly able to compute the optimal 
climbing flight path and speed to avoid crashing to a ground or air obstacle. It 
accomplishes this by using its and other aircraft speed and position, the protection 
areas, the orography of the land, the artificial obstacles placed near airports, and 
any other required information available on board through the a.m. interfaces. 
Additionally other interfaces are foreseen in unit; interfaces with sensors to receive 
row signals in order to calculate automatically an independent present position, 
interfaces with the navigation system to get the present position signals already 
computed by other equipment in order to check the accuracy of the data. 

The collision avoidance system may be optionally doubled to make the system 
even more reliable. 
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Tha second main function carried out by the avionic device, the so-called "alarm 
function", is to allow communication between the aircraft and ground control 
stations or other aircraft The "alarm function" function is also carried out through 
two states. 

The first, the so-called "monitoring state", consists in collecting information on the 
aircraft onboard situation and storing it in the memory unit. This information is not 
automatically transmitted to the ground control stations. In the second state, the 
so-called "alarm state", which is activated in cases of alarm, the unit transmits the 
information generated onboard the aircraft to the ground control stations for 
appropriate evaluation. 

To carry out the alarm function, in addition to the avionic unit described above, it is 
required to install on board additional devices, such as miniature surveillance 
video cameras, miniature transmitters that can be worn by the flight crew, 
switches, cockpit locking systems, specific interfaces, and an appropriate 
communications system. Suitable ground control stations complete the system. 
Other devices may also be connected when required by regulations or airline 
specifications. 

A preferred description of the process carried out by the avionic unit to fulfil the 
alarm function is given below. In the monitoring state, the avionic unit has a 
"surveillance" role and constantly communicates with the video cameras and 
sensors onboard the aircraft. It records the images and the required information at 
pre-determined time intervals, and stores the information and data for a pre- 
determined amount of time. In this state, through interfaces with the collision 
avoidance function, the unit constantly compares the position of the aircraft with 
the expected route in the flight plan; furthermore, the unit continuously 
automatically checks its functions. The system enters the pre-alarm state if a 
hijacking or terrorist act is detected by the sensors or the flight crew, if there is a 
significant deviation from the flight plan or if the cones areas are not respected. In 
this state, a validation request is sent to the nearest ground control station. If this 
is not validated within the predetermined time interval by the ground control 
station, the unit will automatically pass from the monitoring state to the alarm state. 
It goes directly in alarm state if the aircraft flies below the a.m. flight limits. 
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In the alarm state, the unit constantly .transmits the aircraft navigation data and 
other data (for example, images) to ground control stations, and receives 
messages to the flight crew and passengers. Both in the monitoring and in the 
alarm state, the unit works independently of the pilot and, in the event of attested 
terrorist events, it automatically communicates any necessary data to the ground 
control stations. Appropriate measures will be implemented so that, even in the 
case of mechanical damage to the onboard instruments or wiring, the unit is not 
affected. 

The unit have its interfaces with the onboard systems and with the aircraft 
communications system in order to communicate all the necessary data with the 
ground control stations. 

The system comprises a number of miniature surveillance video cameras, which 
are installed in appropriate positions depending on the size of the aircraft and are 
wired to the alarm unit. During the monitoring state, the video cameras 
automatically send a signal if they have been disabled, damaged, or covered. The 
video cameras transmit the images constantly both to the cockpit and to the unit. 
The system comprises several sensors appropriately connected to the alarm unit 
Installed in the aeroplane in appropriate positions depending on the size of the 
aircraft. Preferred sensors are "radio controlled" crew wearable miniature 
transmitters that can be operated with switches. These are "radio controlled" heart 
rate monitors for the pilots, switches on board usable by the flight crew. The flight 
crew may manually activate the sensors, sending different impulses to the avionic 
unit in the event of hijacking or a terrorist act; these transmitters are equipped with 
switches and have specific protective mechanisms to protept against false alarms. 
Furthermore, switches are located in places that may be accessed by the 
passengers as well. Optionally, in case of alarm the unit could automatically lock 
access to the cockpit. 

The system is completed with suitable ground control stations. Preferably, these 
do not receive information during the monitoring state of the unit In the pre-alarm 
state or when the alarm state is confirmed, the ground control stations receive, 
from the concerned aircraft flying in their range, both the information registered 
before the alarm event and real time information from the aircraft . The ground 



WO 2004/008415 



8 



PCT/EP2003/007486 



control stations will perform the following preferred procedure: .provide the 
received information to the competent authorities; continuously check the 
correctness of the flight parameters of the aeroplanes under their control when in 
the pre-alarm state and alarm state; constantly check the aeroplane onboard 
5 situation during hijacking and promptly relay the needed information. An adequate 
number of ground control stations will be located for the proper management of 
the system in the locations deemed necessary by the national authorities. The 
stations will include at least the following systems: adequately powerful computers 
with specifications suitable for the functions to be performed, a receiver-transmitter 

10 radio system, an encryption and coding system, an audio-visual-data 
communications system. The onboard/ground/onboard transmission of the 
information will be performed preferably through a data link connection managing 
audio, data radar and video signals and featuring an encryption and coding system 
capable to provide high resistance to jamming. Transmitted data will be sent with a 

15 suitable data format on appropriate transmission frequencies and with adequate 
waveforms. Spread spectrum techniques (Frequency Hopping or Direct Sequency) 
will be also considered to improve the quality, security, and reliability of the' 
transmission and to avoid interference with other radio transmissions. 
To avoid possible collisions with other aeroplanes in the collision avoidance 

20 function (or in the alarm state) when the autopilot is bringing the aircraft to the pre- 
set spatial position at a certain altitude or flight level, the system will be provided 
with the nearby aircraft position. For example, to accomplish this, the unit may 
receive information coming from General Aviation systems such as the Automatic 
Dependent Surveillance (ADS) system, which is able to transmit the aircraft 

25 position via radio link, or can receive data detected by ground radars, which will 
transmit them to the concerned aircraft in the most appropriate way (exemple, 
through the a.m. ground control station). 

To increase connectivity and minimize the number of ground control stations, the 
system may also operate through a specific satellite Wide Band Data Link 
30 connection. This will allow the aircraft to be monitored when flying over open 
oceans and improve the transmission of images in terms of speed and size, which 
could be very slow if a radio band is used. 
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Optionally, appropriate measures may be implemented in the unit to. electronically 
scan the on board images (for example, to automatically detect the presence of 
firearms). Optionally, narcotic or poisonous gas detectors may be installed on 
board. 

The system also provides a function for handling the emergencies. This considers 
both the possibility that the system may be disabled under the threat of arms and 
the need for the pilot to immediately intervene in the critical phases of a real 
emergency. To achieve the first objective the system always works automatically, 
and cannot be disabled by the pilot, (n case of alarm the system sends messages, 
incuding diabling codes. The use of secure radio bands guarantees a secure 
connection with the ground control stations and makes it possible for the aircraft to 
send automatically, if the alarm event is triggered, standard messages that inform 
the competent authorities of the onboard situation and to receive any disabling 
signals from ground. For this reason it is possible to confirm the. disabling of the 
entire system from a ground control station or from another aircraft after checking 
the received messages (example images). This covers the risk that the system 
may be shut down by accident, by "expert" telecommunications terrorists, or under 
threat of weapons. 

To achieve the second objective, necessary to automatically disable the system 
through the avionic unit. A list of possible of technical-operational-structural 
serious emergencies to be stored in the unit (for example, engine failure) must be 
prepared. Real signals need to be received by the unit through specific interfaces 
with the onboard, systems. When these emergencies occur, a specific software 
will immediately react, giving complete control to the pilot. The unit will then start 
communicating to the ground station, sending the stored and real time data and 
asking for confirmation of the disabling code. In case of confirmation the unit 
automatically disables. 

Thanks to the above characteristics and functions, the system of the invention 
provides real time information on the situation onboard the aeroplane and allows 
the aircraft to fly below the limit altitude or flight level only for taking off or landing, 
preventing the aircraft from descending to any point of the globe unless there is a 
real emergency on board. Thus, the system is able to manage an aircraft out of 
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route, increasing the flight safely , providing to ground, through secure 
communication, the onboard situation in real time. In addition, the system 
increases the day-to-day flight safety since It provides an automatic service that 
prevents the aircraft from descending, even in the event of an error, below the 
5 minimum height established by the regulations, avoiding possible accidents due to 
human and or environmental factors. 

Trie system, thanks to the interfaces with the onboard systems, can optionally take 
the aircraft to an autonomous landing, depending on the aircraft and airport 
equpment configuration. 



